fix: auto-merge Splunk version bump PR as patch release#223
fix: auto-merge Splunk version bump PR as patch release#223mkolasinski-splunk wants to merge 3 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 160b0ca51c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --base main \ | ||
| --state open \ | ||
| --json number \ | ||
| --jq '.[0].number') |
There was a problem hiding this comment.
In the no-new-version path, gh pr list returns an empty JSON array; the gh manual says --jq uses jq query syntax, and this filter evaluates to the literal null for [] rather than an empty string. That makes [ -z "$PR_NUMBER" ] false, so the workflow calls /pulls/null/merge and fails after retries instead of no-oping. Use .[0].number // empty or iterate .[] here so an empty list produces an empty value.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 6614e0e — using .[0].number // empty so an empty PR list yields an empty value instead of the literal string null, letting the no-op path ([ -z "$PR_NUMBER" ]) actually trigger.
gh pr list --jq '.[0].number' on an empty result returns the literal string "null", not empty, so [ -z "$PR_NUMBER" ] was false and the workflow called /pulls/null/merge and failed after retries instead of exiting cleanly. Co-Authored-By: Claude <noreply@anthropic.com>
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…o-merge (ADDON-89092) CI on this repo is minimal and update_deps has been stable; the PR-then-poll-and-merge round trip added latency and a merge-retry loop for no real safety benefit. GH_TOKEN_ADMIN is already the one identity branch protection exempts from the required PR review, so pushing the signed commit straight to main is equivalent in practice and simpler. Co-Authored-By: Claude <noreply@anthropic.com>
|
Redesigned in fc04388: pushing the version-bump commit directly to |
mkolasinski-splunk
changed the title
1 participant
Summary
ADDON-89092: the weekly
update_deps.ymlsplunkjob already opens a "fix: bump Splunk version" PR but leaves it for a human to merge. This adds an auto-merge step that squash-merges that PR (afix:commit → patch release via semantic-release), or cleanly no-ops when there is no new Splunk version that week.Why no branch-protection change
The
splunkjob runs asGH_TOKEN_ADMIN(identitysrv-rr-github-token), which is already listed in this branch'sbypass_pull_request_allowances, and the branch has no required status checks. Verified live on 2026-07-17 that this identity can merge without review; the probe artifacts were fully cleaned up afterward. No branch-protection or ruleset change is required.Scope
splunkjob inupdate_deps.ymlis touched; thesc4sjob is unchanged.GH_TOKEN_ADMINsecret; no new secrets.merge_method=squash), with a short retry loop to absorb the just-created-PR mergeable-state race.delete_branch_on_merge: truehandles branch cleanup.JIRA: https://splunk.atlassian.net/browse/ADDON-89092